4

My company is looking to secure our a Ubuntu 14.04 LTS servers and we wanted to disallow specific users the ability to logon remotely, but still allow people to change over to that user account using SU if needed for support purposes. I found the answer to disallowing SSH logins here:

How do I disable remote SSH login as root from a server?

Would this prevent using SU to change to a user who's been disallowed remote SSH logon ?

Specific example: We don't want people logging over SSH using the account 'specadmin' but user 'mary' may need to log-in and SU to 'specadmin' to perform a few special support duties over a SSH connection, is this possible (while not the best model I am sure). We don't have local access to the servers because they are cloud hosted.

4

No, disabling SSH access in the sshd_config file will not affect the ability to login locally or through the use of su command.


Although you can limit the accounts allowed to connect with SSH as described in the referenced answer (i.e. by setting either DenyUsers specadmin or AllowUsers mary in the /etc/ssh/sshd_config file), it would still be less secure than what is considered a common practice for SSH.

You should not go that way and instead switch to the key-based authentication.

If you are configuring it for the first time, it might seem cumbersome, but as you use cloud services, you can easily add a new server and perform test runs (btw, cloud services usually give you a web access to the console if you lock yourself out).

First you should set (or ensure the following options is set in the sshd_config):

PubkeyAuthentication yes

Then you should generate a key-pair on your client machine (ssh-keygen command on Linux machines) and add the public key to the following file (for mary):

/home/mary/.ssh/authorized_keys

either by copying manually (a key is a string of characters) or using ssh-copy-id mary@<destination_server> command which will upload the key automatically.

You should be able to connect to the server using ssh mary@<destination_server> using the key. If you set the passphrase during ssh-keygen, which you should, you will need to enter it, but it will not be transferred between the client and the server. To be really sure you are doing things correctly set a passphrase to the key file different from the password on the destination server.

If you can successfully login using the key authentication (and passphrase), you can proceed to disabling password based one by adding/ensuring the following settings in sshd_config:

PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
IgnoreRhosts yes
IgnoreUserKnownHosts yes
HostbasedAuthentication no

After the changes to the sshd_config you should of course restart the SSH daemon (sudo service ssh restart) on the server.


For peace of mind you might also want to disallow access via SSH for the root account in the sshd_config (although if you perform the above, root won't be able to login by default):

PermitRootLogin no
5
  • That's exactly the answer I needed, thank you. I didn't want to lock us out. I was a Windows guy....but that is.no more! :D Thank you for the fast turnaround! – jjthomas3rd Jul 20 '16 at 12:35
  • Extra +1 for the mention of disallowing root login! – Arronical Jul 20 '16 at 12:39
  • And keys (though my answer now looks a bit silly!). – Arronical Jul 20 '16 at 12:40
  • @jjthomas3rd What exactly is your configuration? Is the server open to the Internet, or do you use a VPN to the cloud? I am getting concerned with your "locking out" comment. – techraf Jul 20 '16 at 12:42
  • No its internal to our company only via a VPN.. I did find a web interface to reset passwords so all good. – jjthomas3rd Jul 20 '16 at 20:32
1

It's the exact use case for the DenyUsers and AllowUsers lines in the file /etc/ssh/sshd_config. You can log in as an allowed user, and su to the privileged user when required.

Also, if you want to beef up your security measures, you should look into using passphrase protected certificate-based authentication to log in as your regular users (such as Mary). It's quite simple to set up, and adds an extra layer of security to your system.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.